ustream uses X509_check_host to perform the validation, and that call is present in wolfssl since v3.10.4, depending on the build-time configure options. Currently, openwrt always builds support for it. It currently does not support X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS, so no flags are being used, which should be good enough.
Nonetheless, the call is being checked in CMakeLists.txt, just in case wolfssl build options change. Without CN validation, uclient-fetch will fail to run unless the --no-check-certificate option is used. Signed-off-by: Eneas U de Queiroz <cotequei...@gmail.com> --- This was run-tested on WRT3200ACM running openwrt master diff --git a/CMakeLists.txt b/CMakeLists.txt index b99b242..8dbdb89 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -23,6 +23,11 @@ ELSEIF(CYASSL) IF (HAVE_WOLFSSL_SSLSETIORECV) ADD_DEFINITIONS(-DWOLFSSL_SSLSETIO_SEND_RECV) ENDIF() + CHECK_SYMBOL_EXISTS (X509_check_host "openssl/ssl.h" + HAVE_X509_CHECK_HOST) + IF (HAVE_X509_CHECK_HOST) + ADD_DEFINITIONS(-DHAVE_X509_CHECK_HOST) + ENDIF() ENDIF() ADD_DEFINITIONS(-DHAVE_CYASSL) SET(SSL_SRC ustream-io-cyassl.c ustream-openssl.c) diff --git a/ustream-openssl.c b/ustream-openssl.c index b2df362..ab763f3 100644 --- a/ustream-openssl.c +++ b/ustream-openssl.c @@ -203,7 +203,7 @@ static void ustream_ssl_error(struct ustream_ssl *us, int ret) uloop_timeout_set(&us->error_timer, 0); } -#ifndef CYASSL_OPENSSL_H_ +#if !defined(CYASSL_OPENSSL_H_) || defined(HAVE_X509_CHECK_HOST) static bool ustream_ssl_verify_cn(struct ustream_ssl *us, X509 *cert) { @@ -212,7 +212,11 @@ static bool ustream_ssl_verify_cn(struct ustream_ssl *us, X509 *cert) if (!us->peer_cn) return false; +# ifndef CYASSL_OPENSSL_H_ ret = X509_check_host(cert, us->peer_cn, 0, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS, NULL); +# else + ret = X509_check_host(cert, us->peer_cn, 0, 0, NULL); +# endif return ret == 1; } @@ -252,7 +256,7 @@ __hidden enum ssl_conn_status __ustream_ssl_connect(struct ustream_ssl *us) r = SSL_connect(ssl); if (r == 1) { -#ifndef CYASSL_OPENSSL_H_ +#if !defined(CYASSL_OPENSSL_H_) || defined(HAVE_X509_CHECK_HOST) ustream_ssl_verify_cert(us); #endif return U_SSL_OK; _______________________________________________ openwrt-devel mailing list openwrt-devel@lists.openwrt.org https://lists.openwrt.org/mailman/listinfo/openwrt-devel